HA sync overwrites certificates on backup router even if unchecked
-
I set up ACME/LE certs on our two data center routers yesterday. Twice since then I have noticed the cert is missing on the backup router, even though I disabled sync of certificates:
I'm assuming that is not expected? The backup router web server is left running with a live cert, but the web server cert dropdown is set to "IKEv2 server," the first cert it has in its list. So presumably would break upon restart. The CAs are overwritten and the router1 cert is on router2 as well so they all sync'd.
If expected, what is the solution, to use a wildcard cert? That's what we previously had, so had been syncing certs on purpose.
These routers are still on 25.07, though I don't see anything in later release notes about this.
-
If I read a bit further in the list I get to "OpenVPN configuration (Implies CA/Cert/CRL Sync)". We don't use that anymore so I suppose can uncheck that.
-
@SteveITS I use acme to obtain a certificate with three hostnames, fw-xyz.domain.com (CARP VIP), fw-a-xyz.domain.com (Primary), and fw-b-xyz.domain.com (Secondary). This runs on the primary and syncs to the secondary. Works great.
-
@Derelict Yeah, that’d be the other option and basically what we did with the wildcard cert. Might be cleaner to let the certs sync. It just surprised me to carefully test it all on r2, set up one cert on r1, and everything disappeared on r2.
We were using the wildcard in a lot of places but are looking to avoid replacing that many cert locations every 47 days going forward… :(
